PT-2026-97544

Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description A flaw exists in the install-bundle endpoint. When a System Administrator downloads an install bundle for an execution or hop node, the controller signs an X.509 certificate usi...

PT-2026-97278

The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsget app manager, which just hands back the manager object from...

PT-2026-97328

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.2 Description REDAXO is a PHP-based content management system. The rex api install package update function within the install addon fails to override the requiresCsrfProtection method, which defaults to false in t...

CVE-2026-84716: Incorrect Privilege Assignment

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

CVE-2026-96455: Missing Authentication for Critical Function

The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...

Malicious code in @tvg-mar/promos-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...

MAL-2026-16412 Malicious code in @tvg-mar/promos-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...

MAL-2026-16413 Malicious code in @tvg-mar/promos-gtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...

Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...

MAL-2026-16415 Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...

Malicious code in poly-check-b (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...

MAL-2026-16389 Malicious code in noverojava (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7fbf0d1519b05868b34e9e2c1d3588a0596003a5cb53e4cd28fd3a856ecff26 package.json declares the runtime dependency libsignal as github:tenka-san/libsignal-node rather than a registry version range or pinned commit SHA. ...

Malicious code in @mr-supun-fernando/supunmd-bail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19 package.json declares "libsignal": "github:tenka-san/libsignal-node" — an off-registry dependency source pointing at a personal-user GitHub repositor...

MAL-2026-16387 Malicious code in @mr-supun-fernando/supunmd-bail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19 package.json declares "libsignal": "github:tenka-san/libsignal-node" — an off-registry dependency source pointing at a personal-user GitHub repositor...

MAL-2026-16378 Malicious code in @tesla-insurance/vinless-quote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730 The package declares an install lifecycle script node index.js that loads runtime/support/telemetry/probe/impl.js. On npm install, this probe collect...

Malicious code in @tesla-insurance/vinless-quote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730 The package declares an install lifecycle script node index.js that loads runtime/support/telemetry/probe/impl.js. On npm install, this probe collect...

Malicious code in @baanx/blockchain-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6dec4d715e2863e7f55749d6d2a390926f3f2f1df62e4de223c6acc818632d The package runs a bootstrap from both its install lifecycle script node index.js and its main module that invokes an obfuscated probe. The probe rea...

Malicious code in bulk-add-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023 Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects...

Malicious code in byted-commerce-materials (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collec...

Malicious code in @siriusbeyond/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72 On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity hostname, username,...